Skip to content

Commit a4fcbac

Browse files
committed
rtlbtfw(8): Fix incorrect chunk index overwrap in rtlbt_load_fwfile()
It prevented large (>256 chunks) firmwares from loading. Fixes: 5036d96 ("rtlbtfw: Firmware loader for Realtek 87XX/88XX") Sponsored by: Future Crew, LLC MFC after: 1 week
1 parent 7a7ab34 commit a4fcbac

1 file changed

Lines changed: 5 additions & 6 deletions

File tree

usr.sbin/bluetooth/rtlbtfw/rtlbt_hw.c

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -189,19 +189,18 @@ rtlbt_load_fwfile(struct libusb_device_handle *hdl,
189189
uint8_t *data = fw->buf;
190190
int frag_num = fw->len / RTLBT_MAX_CMD_DATA_LEN + 1;
191191
int frag_len = RTLBT_MAX_CMD_DATA_LEN;
192-
int i;
192+
int i, j;
193193
int ret, transferred;
194194

195-
for (i = 0; i < frag_num; i++) {
195+
for (i = 0, j = 0; i < frag_num; i++, j++) {
196196

197197
rtlbt_debug("download fw (%d/%d)", i + 1, frag_num);
198198

199199
memset(cmd_buf, 0, sizeof(cmd_buf));
200200
cmd->opcode = htole16(0xfc20);
201-
if (i > 0x7f)
202-
dl_cmd->index = (i & 0x7f) + 1;
203-
else
204-
dl_cmd->index = i;
201+
if (j > 0x7f)
202+
j = 1;
203+
dl_cmd->index = j;
205204

206205
if (i == (frag_num - 1)) {
207206
dl_cmd->index |= 0x80; /* data end */

0 commit comments

Comments
 (0)